A certificate authority may create for a server a certificate that binds an identity of the server to a public key of the server, where the certificate is digitally signed by the certificate authority. The server may authenticate itself to a client by presenting to the client the certificate issued by the certificate authority. The client, which is in possession of a root certificate of the certificate authority, may use the root certificate to validate the certificate received from the server.
As part of the certificate validation, the client may be required to compare an identity indicated in the received certificate to an identity of the server with which the client is communicating. If the identities are not identical, the received certificate cannot be validated and the server will not be authenticated to the client.
Appendix A is an example X.509 root certificate; and
Appendix B is an example X.509 derived certificate that is digitally signed by the example X.509 root certificate of Appendix A.